To test this feature, visit your live site.

Wildfire Disabled due to configuration though profile applied to multiple security rules through profile groups

Working through the kbs, we see a status of Disabled due to configuration, which should indicate that the wildfire profile is not applied to security policies, but it is applied to every allow rule through a security profile group. PAN-OS 9.1.13-h3 I searched for known issues and did not find them. The firewall is receiving wildfire updates, but there are no logs for wildfire submissions, though it is set to send everything.

Am I missing something obvious?

Thank you very much!

6 comments

Comments (6)

Squeaker

Oct 13, 2022

I'm not entirely sure what oddities I should look for. They are set to use the public cloud at wildfire.paloaltonetworks.com. Default size limits for all file types. It is not set to report benign files or grayware, though I will change the grayware setting as soon as they approve.

What am I missing?

Thank you!

Squeaker

Oct 13, 2022

Replying to

The firewall is not in FIPS mode. They are not decrypting traffic. The wildfire profile is configured and applied to a majority of the allow rules via a profile group, though it is not directly applied to any security rule.

Reaper

Oct 13, 2022

Replying to

Profile group is just fine, decryption is a bit of a must however, as otherwise you won't be able to see most files passing over the firewall

Squeaker

Oct 13, 2022

Replying to

Thanks!

Would that result in the "Disabled due to configuration" status?

Reaper

Oct 13, 2022

Did you check device > setup > wildfire for oddities?

Forum: Forum